Expanso sentiment-score

Analyze text and return a sentiment score from -1 (negative) to +1 (positive) using Expanso Edge.

Security Scan

The skill's files and instructions match its stated purpose (scoring sentiment) and there are no hidden install steps or unrelated credentials, but it will send user text to OpenAI and has a small mismatch around the OPENAI_API_KEY being referenced without being required — review data-sensitivity and deployment choices before use.

Purpose & Capability

The name/description and pipeline files implement a sentiment scoring pipeline that calls an LLM and returns score/label/confidence. The included files (pipeline-cli.yaml, pipeline-mcp.yaml, skill.yaml) align with the stated purpose.

Instruction Scope

Runtime instructions are limited to running expanso-edge with the provided pipeline YAMLs or deploying to Expanso Cloud. The pipelines construct an LLM prompt and send user text to an OpenAI chat completion; they do not read arbitrary system files or request unrelated environment variables. The MCP pipeline opens an HTTP endpoint (0.0.0.0:${PORT:-8080}) which will expose the /score POST endpoint if you run it.

Install Mechanism

This is an instruction-only skill with no install spec and no downloaded code. The SKILL.md asks that expanso-edge be installed via clawhub, but that is external to the skill bundle. There are no archives or remote download URLs in the manifest.

Credentials

Both pipeline YAMLs reference ${OPENAI_API_KEY}, but the registry metadata lists no required env vars and skill.yaml marks OPENAI_API_KEY as required: false. That mismatch is potentially confusing: if you run these pipelines without an API key they will fail or you may unintentionally use a remote backend. Also note the pipeline will send user-provided text to OpenAI (data exfiltration risk for sensitive content).

Persistence & Privilege

The skill does not request always: true, has no special persistence, and doesn't alter other skill configs. It is user-invocable and can be run/hosted by the user; MCP mode will bind to a network port if you run it.

Assessment

This skill appears to do what it says (sentiment scoring) and contains only pipeline YAMLs. Before installing/running: 1) Be aware that running either pipeline will send submitted text to OpenAI (ensure you are allowed to transmit that data and consider redacting PII or using a local backend). 2) If you will run the MCP pipeline, it binds to 0.0.0.0 by default—limit exposure (use a firewall, bind to localhost, or set PORT appropriately). 3) The pipelines reference OPENAI_API_KEY but the skill metadata marks it optional — set the API key if you intend to use OpenAI, or configure the local ollama backend instead. 4) Review and verify the expanso-edge / clawhub install sources before installing external binaries. If you want, I can point out exactly where to change the pipeline to avoid sending text to OpenAI (e.g., swap to a local model) or how to run the MCP endpoint safely behind a reverse proxy.

sentiment-score

"Score text sentiment from -1 (negative) to +1 (positive)"

Requirements

• Expanso Edge installed (expanso-edge binary in PATH)
• Install via: clawhub install expanso-edge

Usage

CLI Pipeline

# Run standalone
echo '<input>' | expanso-edge run pipeline-cli.yaml

MCP Pipeline

# Start as MCP server
expanso-edge run pipeline-mcp.yaml

Deploy to Expanso Cloud

expanso-cli job deploy https://skills.expanso.io/sentiment-score/pipeline-cli.yaml

Files

File	Purpose
skill.yaml	Skill metadata (inputs, outputs, credentials)
pipeline-cli.yaml	Standalone CLI pipeline
pipeline-mcp.yaml	MCP server pipeline